GuiClass[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

GuiClass.exe
Size

2.5MB
MD5

454de462d777b0cea86001dada13a25b
SHA1

72834474faf292f1d2b84ef6f13ca5f46b1927dc
SHA256

c42d7fdc625fb5243ec2f9685120aec1059dcd753f735460b9b4ad180f97cd2b
SHA512

3d38bc87eb967b912b1e5daad6434893bd82579bd07d78778e75268e042fa8791adbfbc9b3d06ea3e19fd469d9466e0d572b8bbcbcd3182b37d4f2f512424553
SSDEEP

24576:wFRhNUk40pnJRiwxOVf3OOOPI8w8q5EDkc8bTxZlYgUlrrP58CY9Q3YtfKVdLNuW:OddnqvdY74Q3gnaXwIXPb3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GuiClass.exe

Files

GuiClass.exe
.exe windows:6 windows x64 arch:x64

Password: GuiClass-25

29d66344016c81fdad31c60cfc30fe08

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

opengl32

glClear

kernel32

TlsFree
VerSetConditionMask
GetLastError
GetModuleHandleExW
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryA
Sleep
GetStartupInfoW
GetModuleHandleW
GlobalAlloc
TlsGetValue
GlobalLock
GlobalFree
SetThreadExecutionState
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
TlsSetValue
TlsAlloc
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
Process32Next
Process32First
CreateToolhelp32Snapshot
InitializeSListHead
GetConsoleWindow
SetConsoleTextAttribute
GetLocalTime
CloseHandle
GetStdHandle
GetSystemTimeAsFileTime
GlobalUnlock

user32

GetKeyState
SetCapture
ReleaseCapture
MsgWaitForMultipleObjects
GetSystemMetrics
SetForegroundWindow
SetPropW
GetPropW
RemovePropW
SetWindowTextW
GetClientRect
GetWindowRect
AdjustWindowRectEx
SetCursorPos
SetCursor
GetCursorPos
ClientToScreen
ScreenToClient
WindowFromPoint
ClipCursor
SetRect
OffsetRect
PtInRect
GetWindowLongW
SetWindowLongW
GetClassLongPtrW
GetActiveWindow
LoadImageW
OpenClipboard
SystemParametersInfoW
MonitorFromWindow
GetRawInputData
RegisterRawInputDevices
GetRawInputDeviceInfoA
GetRawInputDeviceList
GetMessageExtraInfo
CallWindowProcW
GetWindowLongPtrW
SetWindowLongPtrW
SetFocus
SetLayeredWindowAttributes
GetLayeredWindowAttributes
WaitMessage
PostMessageW
SendMessageW
GetMessageTime
TrackMouseEvent
EnumDisplayMonitors
GetMonitorInfoW
EnumDisplayDevicesW
EnumDisplaySettingsExW
EnumDisplaySettingsW
ChangeDisplaySettingsExW
ReleaseDC
EmptyClipboard
GetClipboardData
SetClipboardData
LoadCursorW
CloseClipboard
IsZoomed
BringWindowToTop
IsIconic
IsWindowVisible
SetWindowPlacement
GetWindowPlacement
SetWindowPos
MoveWindow
GetDC
DestroyIcon
MapVirtualKeyW
ToUnicode
DestroyWindow
CreateIconIndirect
ShowWindow
TranslateMessage
DispatchMessageW
PeekMessageW
RegisterDeviceNotificationW
UnregisterDeviceNotification
DefWindowProcW
UnregisterClassW
FlashWindow
RegisterClassExW
CreateWindowExW

gdi32

DeleteObject
DeleteDC
GetDeviceCaps
GetDeviceGammaRamp
SetDeviceGammaRamp
CreateBitmap
CreateRectRgn
CreateDIBSection
ChoosePixelFormat
DescribePixelFormat
SetPixelFormat
SwapBuffers
CreateDCW

shell32

DragQueryPoint
DragQueryFileW
DragFinish
DragAcceptFiles

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext

vcruntime140

__current_exception_context
__current_exception
__C_specific_handler
strstr
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcmp
memcpy
memmove
memset
memchr
strchr
__std_terminate

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
terminate
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_register_thread_local_exe_atexit_callback
__p___argc
__p___argv
_c_exit

api-ms-win-crt-string-l1-1-0

strncpy
strcspn
strspn
strncmp
tolower
strcmp

api-ms-win-crt-stdio-l1-1-0

__p__commode
fseek
ftell
fwrite
__stdio_common_vsprintf
__acrt_iob_func
fread
fflush
fclose
__stdio_common_vfprintf
_wfopen
_set_fmode
__stdio_common_vsscanf

api-ms-win-crt-heap-l1-1-0

_callnewh
_set_new_mode
malloc
realloc
free

api-ms-win-crt-math-l1-1-0

fminf
fmaxf
ceilf
cosf
fmodf
sqrtf
acosf
sinf
powf
__setusermatherr

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 317KB - Virtual size: 316KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 173KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: GuiClass-25

29d66344016c81fdad31c60cfc30fe08

Headers

DLL Characteristics

File Characteristics

Imports

opengl32

kernel32

user32

gdi32

shell32

msvcp140

imm32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 317KB - Virtual size: 316KB

.rdata Size: 173KB - Virtual size: 173KB

.data Size: 2.0MB - Virtual size: 2.0MB

.pdata Size: 16KB - Virtual size: 16KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 317KB - Virtual size: 316KB

.rdata
Size: 173KB - Virtual size: 173KB

.data
Size: 2.0MB - Virtual size: 2.0MB

.pdata
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1KB - Virtual size: 1KB